Two machines, one certificate
Worth reading first: What a regression test can ask for · The same program, twice.
Seventeen essays of this field describe a quantity nothing reports. This one is about what could be reported instead, and the answer is short enough to act on: four numbers, each about one pass over data the routine is already holding.
Why a residual is not enough
Start with the instrument this collection was built on, because the field’s most useful negative result is about it.
Every figure here carries a residual badge, and the site’s own rule — no decomposition drawn without its residual printed — is enforced by a gate. The residual is the right instrument for the second author of error: it says how far the data would have to move for this answer to be exact, and it is computable without knowing the answer.
It cannot see the fifth author, for two reasons that are worth keeping apart.
It is computed in the arithmetic being questioned. A residual b − Ax is a reduction. Its own value depends on the partitioning, and on a build where the multiply-add was contracted it is contracted too. So it reports agreement with itself, which is the refusal this essay’s refutation names.
And it is a statement about one run. Even computed exactly, a residual says this answer is good. It says nothing about whether the next run will produce the same one, because — as accuracy and agreement are different properties sets out — every answer in the set has a small residual and they are all different.
So the four candidates below are not replacements for a residual. They are the second column a residual has never had.
One: κ of the reduction
Σ|xᵢ| ÷ |Σxᵢ|, for the sums the answer was built from.
What it settles. How far two machines’ answers can be from each other: a bound every answer satisfies measures the disagreement at 0.253 to 0.258 times κu across ten decades, so κ converts the answers might differ into a number, good to a factor of two.
What it costs. One accumulation and one absolute value per element, on a loop that already reads every element. Under a factor of two on a memory-bound reduction and nothing at all on a compute-bound one.
Its limits. It describes the reduction and not the computation around it. A solver whose trajectory amplifies a perturbation over hundreds of steps — which a stopping test is a race measures at sixteen iterations from a 10⁻¹³ perturbation — needs κ and an amplification factor, and only the first is cheap.
It is the best value of the four, and it is the one no library computes.
Two: the partition count
The integer the runtime chose.
What it settles. Reproducibility, in the strongest sense available without changing the arithmetic: a second run on a machine that divides the work the same way returns the same bits. It turns this cannot be reproduced into this can be reproduced given one more piece of information.
What it costs. Nothing. The runtime knows it.
Its limits. It is necessary and not sufficient, because a work-stealing scheduler moves the cut points at a fixed count — the open dots in the same program, twice — so the full record is the count and the schedule, and only the first is a small number. And it is a property of a runtime rather than of a computation, so nothing in a numerical library’s interface has a place to put it.
That is a gap in interfaces rather than in numerics, which is why it is the second item and not the first: it is the cheapest thing on the list and the one furthest outside a numerical analyst’s control.
Three: an exactly accumulated residual
b − Ax, computed with an error-free product expansion and an exactly rounded sum.
What it settles. It removes the first of the two objections above: a residual computed exactly is a residual computed in arithmetic that no partitioning and no contraction can move, so two machines that disagree about the answer agree about how good each other’s answers are. That is a genuinely useful thing — it makes a residual a shared standard rather than each machine’s own opinion.
What it costs. About twelve operations an element and a list of partials, which what determinism costs prices at 5% of a conjugate gradient step on a dense matrix and a doubling on a five-point stencil. For a residual computed once at the end rather than every iteration, it is free.
Its limits. It certifies each answer separately and still says nothing about the set. Two machines with exactly accumulated residuals of 3.1·10⁻¹⁶ and 4.7·10⁻¹⁶ have learned that both answers are good and not that they are the same.
Four: a directed-rounding interval
Compute the answer twice, once with every operation rounded down and once up, and report the pair.
What it settles. The most, and it is the only candidate that settles anything about a set: the interval contains the exact answer, and therefore contains every ordering’s answer, so two machines report overlapping intervals whose intersection contains the truth. That is the strongest statement available without making the computation order-independent, and it is what proving the answer is in the box builds.
What it costs. About a factor of two in arithmetic and access to the rounding modes, which the directed-rounding essays’ machinery already needs. On an iterative method the interval also grows with the iteration count, which is the well-known limitation of naive interval arithmetic and the reason the interval field’s essays are careful about where they apply it.
Its limits. A wide interval is honest and unhelpful. And it does not identify the answer either: it says the truth is in here and so is every run, which is the same shape of statement as the classical bound and a much tighter version of it.
The four, compared
Setting them side by side is the point of the essay, because each settles a different question and none settles all of them.
| cost | settles | does not settle | |
|---|---|---|---|
| κ of the reduction | one pass | how far two runs can be apart | which run arrived |
| the partition count | free | reproducibility given the same runtime | anything about accuracy |
| an exact residual | ~12 ops/element, once | how good this answer is, on any machine | whether another machine agrees |
| a directed-rounding interval | ×2 arithmetic | that the truth and every run are in here | which point in the interval |
Two readings.
None of them identifies the answer, and that is not a failure of the list. Identifying the answer requires knowing the partitioning and the schedule, which is a description of an afternoon rather than a number. What the four do is bound, describe, or make independent.
And they are complementary rather than alternatives. κ says how much disagreement to expect; the exact residual says each answer is sound; the interval says where the truth is; the partition count says how to get the same one back. A claim carrying all four is a claim a reader on another machine can check completely, and the total cost is about one extra pass plus a doubling of one final computation.
The one that is not a certificate
Worth naming so it is not mistaken for one: making the reduction order-independent is not a report, it is a repair. It costs three operations an element, it removes the disagreement rather than describing it, and where a verdict is downstream it is the right thing to do — the sum that cannot be wrong is the method and what determinism costs is the price.
The four above are for the situation where the computation cannot be changed: somebody else’s library, a binary, a result that already exists.
A worked report
To make the recommendation concrete, here is what a solve on this field’s own test problem would say if it said everything, and it fits in five lines.
x : 200 numbers
residual : 8.4e-11 (relative, recurrence)
: 9.1e-11 (relative, recomputed exactly)
kappa_sum : 4.1e+02 (the reduction the stopping test reads)
expect : two runs to differ by about 9e-14 relative
partition : 8 pieces, static
iterations : 683
Every line is available in the routine. Three of them are printed by existing software: the answer, one residual and the iteration count. The other three are the field’s request.
And they are what turns the exchange this field keeps describing — the answer moved and nothing changed — into an ordinary observation. A second run reporting 681 iterations and an answer 7·10⁻¹⁴ away is a second run behaving exactly as the first one predicted it would.
What to actually do
The recommendation, ordered by what it costs.
Always: report κ of the reductions whose value is compared with anything. One pass. It is the number that turns an anecdote into a prediction, and it is the difference between the answers moved and the answers moved by 0.25κu, as they must.
When storing a result for later comparison: store the partition count and the library version beside it. Two integers, and they convert an unreproducible number into a reproducible one — or, when they cannot, they say which of the field’s three causes was responsible.
When a claim leaves the machine: compute the residual exactly. Once, at the end. It makes the claim’s evidence independent of the arithmetic that produced the claim, which is what certificate should mean.
And when the answer is a decision rather than a number: do not certify it, remove the decision. A rank, a definiteness verdict, a stopping step — none of the four candidates makes an integer stable. The repair there is an order-independent reduction, or reporting the spectrum instead of the count, which is rank is a decision’s argument arriving from a new direction.
Where the four fail together
One situation defeats all of them, and it is the field’s third cause.
None of the four says anything about algorithm selection. A library that switches kernels at a length, or dispatches on the processor’s vector width, produces a different computation rather than a different ordering of one — so κ describes a reduction that was not performed, the partition count describes a division that did not happen, an exact residual certifies an answer without saying which algorithm produced it, and an interval computed on one code path says nothing about the other.
The length that changes the kernel measures a step of 1.57× in accuracy at a size no part of the problem knows about, and the only thing that pins it is a version number. So the honest list has a fifth item and it is not a numerical quantity: record the library version and the machine, which is ordinary software practice, given a numerical reason.
The general shape is worth carrying past this field. A certificate can only describe what it can see, and a computation’s identity — which algorithm ran, on which hardware — is upstream of every number the computation produces.
Why “certificate” is the right word
The word has a precise sense in this collection and it is worth not diluting it.
Proving the answer is in the box is the site’s one computation that proves something: a Krawczyk operator mapping a box into itself is a proof, from finitely many floating-point operations, that a solution exists inside it and is unique. That is a certificate in the strong sense — a finite object whose verification establishes a claim about infinitely many points.
Two of the four candidates here are certificates in that sense and two are not.
The interval is. It is checkable by a reader, it establishes containment, and the machine that produced it is irrelevant to whether it is valid.
The exact residual is, nearly. It establishes a backward error, its verification requires recomputing it, and the recomputation is order-independent — so two readers agree about it.
κ is a prediction, not a proof. It says how far apart runs will be, to within a factor of two, which is a statement about a distribution rather than a guarantee about a pair.
And the partition count is a coordinate. It records where the answer came from so that it can be found again. Useful, and not evidence of anything.
Keeping those apart matters because a reader who has been told a number is “certified” will treat all four the same way, and only one of them is a proof.
What checking one costs
The table above prices these four for whoever produces them. The other half of the question is what they cost the reader, and the four separate again — differently, and along a line worth seeing.
The partition count is checkable only on the original machine. Re-running with the same p on a box with a different vector width, a different kernel or a different number of workers reproduces the coordinate and not the answer. Its verification needs the thing it was supposed to make unnecessary, which is why it sits at the bottom of the list despite being free.
κ is cheap to check and rarely checkable. One pass over the vector, by anyone holding the vector — and the vector is almost never published, so in practice a reported κ is taken on trust. The vector that hides it is the reason that matters: κ is a property of the data, so a claim that ships without its data has moved the quantity out of reach.
The exact residual costs the reader exactly what it cost the producer, and it is worth the symmetry: recomputing it from the matrix, the right-hand side and the answer is order-independent, so two readers on two machines get the same bits and can disagree about nothing.
The interval is the cheapest of all to check — containment is a comparison of two numbers — while reproducing it from scratch needs rounding-mode control the reader may not have.
The pattern is the one the previous section named from the other direction. The two that verify without reference to the machine that produced them are the two that are certificates in the strong sense, and that is not a coincidence: a claim whose checking depends on where it was made is a claim about that place.
What this field asked for, in one place
Since this is the field’s last essay, the whole of what it wants is worth putting in one list, and it is notable how little of it is research.
- κ beside a reduction — one pass, nobody computes it.
- The partition count in the output — free, no interface has a slot for it.
- The kernel cutoffs in the documentation — already in the source, never described as affecting results.
- An order-independent mode — decades old, present in almost no default.
- And three sentences in a specification instead of one: that the answer is exact for nearby data, that two runs may differ by about κu, and that the reproducible mode makes the answer a function of the inputs.
Every item is available today. What was missing is the reason to think of them as one thing, which is what the fifth author is a name for.
One line
Nothing a solver returns says which of its answers arrived, and four things that would each cost about one pass over data the routine is already holding.
At other settings
Shares its objects with
Essays that name at least two of the same things, and that neither author linked.
- An inner product with no fixed sign — both name bitwise reproducibility, run-to-run variation, summation condition number
- A bound that is proved — both name directed rounding, interval arithmetic
- The direction the error leans — both name directed rounding, interval arithmetic
- The tolerance that buys no agreement — both name bitwise reproducibility, run-to-run variation
- The variation that comes with a seed — both name bitwise reproducibility, run-to-run variation
- Where the disagreement comes from — both name run-to-run variation, summation condition number
Named objects
A flat tag is an object no other essay names yet.
Algorithm selectionBitwise reproducibilityCertificateDirected roundingExact accumulationInterval arithmeticRegression toleranceRun-to-run variationSummation condition number